I am seeing issues with the pwmEventLog attribute and password changes.
It is further encapsulating attributes on each password change.

<?xml version="1.0" encoding="UTF-8"?>
<history>
<record timestamp="1447104811603" eventCode="EventLog_ChangePassword"
srcIP="[Attribute: srcIP=&quot;[Attribute:
srcIP=&quot;IPV4addr&quot;]&quot;]" srcHost="[Attribute:
srcHost=&quot;[Attribute: srcHost=&quot;FQDN&quot;]&quot;]" />
<record timestamp="1447173195228" eventCode="EventLog_ChangePassword"
srcIP="[Attribute: srcIP=&quot;IPV4addr&quot;]" srcHost="[Attribute:
srcHost=&quot;FQDN&quot;]" />
<record timestamp="1447175527107" eventCode="EventLog_ChangePassword"
srcIP="IPV4addr" srcHost="FQDN" />
</history>


Here is the build info: SSPR v3.3.0.2 b20 r38620


--
schwoerb
------------------------------------------------------------------------
schwoerb's Profile: https://forums.netiq.com/member.php?userid=2338
View this thread: https://forums.netiq.com/showthread.php?t=54625